Loading story…
Red Hat released RHSA-2024:6990, an Important security update for the real-time kernel on Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions on x86_64. The update delivers kernel-rt-5.14.0-70.117.1.rt21.189.el9_0, addressing 11 Linux kernel vulnerabilities across sparse-memory handling, networking, ACPICA, RDMA, vsock, perf, SUNRPC, and mac80211 Wi-Fi components. Red Hat did not report active exploitation of the flaws.
Notable fixes include CVE-2023-52489, a locally exploitable sparse-memory race condition that can compromise availability through denial of service when compaction processes device-memory PFNs, and CVE-2024-40995, which can trigger an infinite loop and system-wide task hangs in the traffic-control action API when multiple actions use the same index. The advisory also includes a fix for CVE-2021-47393 affecting the mlxreg-fan hardware-monitoring driver. Administrators should install the updated kernel-rt package and reboot affected systems to activate the fixes.
See real exploitation activity before you spend the cycle.
6 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2024:2950 for the RHEL 8 kernel-rt package and RHSA-2024:3138 for the RHEL 8 kernel package, both addressing CVE-2023-52489.
Red Hat released RHSA-2024:2394, updating the RHEL 9 kernel to remediate CVE-2023-52489.
Red Hat published its record for CVE-2023-52489, a moderate-severity Linux kernel sparse-memory race condition that can affect system availability.
Red Hat released RHSA-2024:10262, updating the RHEL 8.8 Extended Update Support kernel package to remediate CVE-2023-52489.
Red Hat released RHSA-2024:8613 and RHSA-2024:8614, updating RHEL 9.2 Extended Update Support kernel and kernel-rt packages to address CVE-2023-52489.
Red Hat released RHSA-2024:6990 and RHSA-2024:6991 for RHEL 9.0 Update Services for SAP Solutions, fixing CVE-2023-52489 in kernel-rt and kernel packages. RHSA-2024:6990 required affected systems to reboot after installation for the update to take effect.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceredhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Important kernel and real-time kernel updates for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, delivering `kernel` version `5.14.0-70.105.1.el9_0` for x86_64, ppc64le, aarch64, and s390x, and `kernel-rt` version `5.14.0-70.105.1.rt21.177.el9_0` for x86_64. The updates remediate **CVE-2024-0193**, a Netfilter use-after-free vulnerability in which local unprivileged users could potentially escalate privileges by triggering double deactivation during pipapo-set removal and catchall-element garbage collection. The advisories also address **CVE-2023-52434**, an SMB client out-of-bounds flaw caused by inadequate validation of SMB2 create-context offsets and lengths; Red Hat rates it 5.9 CVSS and considers adjacent-network denial of service the most likely impact. The standard kernel update additionally fixes a KVM use-after-free issue and a Netfilter protocol-number sanitization weakness, while the real-time update includes the latter Netfilter flaw. Administrators should apply the applicable packages and reboot affected systems for the fixes to take effect; preventing the `cifs` module from loading can mitigate the SMB issue until patching is complete.
Aug 26, 2026
Red Hat released Moderate-severity Linux kernel security updates for RHEL 9.0 SAP Solutions, RHEL 9.2 SAP and associated offerings, and RHEL 10/10.2 variants. The advisories remediate vulnerabilities in networking, HID, SCTP, ALSA audio, RDMA, KVM, event polling, TLS, cryptographic, and Wi-Fi code, including buffer overflows, use-after-free conditions, and recursion that could exhaust kernel resources. Key fixes include `CVE-2025-38614` in eventpoll, `CVE-2025-39864` in cfg80211, `CVE-2025-39903` affecting NUMA memory-node handling, and `CVE-2025-39946` in TLS stream handling. Affected organizations should deploy the applicable kernel packages—`5.14.0-70.151.1.el9_0` for RHEL 9.0 SAP, `5.14.0-70.151.1.rt21.223.el9_0` for its real-time kernel, and `5.14.0-284.144.1.el9_2` for RHEL 9.2 SAP—across x86_64, aarch64, ppc64le, and s390x systems as applicable. Red Hat requires a reboot after installation for mitigations to take effect; its kernel maintenance also includes a resolved Intel SOF HDA issue, `CVE-2022-50050`, where unsafe handling of `snprintf()` output could lead to a buffer overflow.
Aug 26, 2026
Red Hat released Important security updates for Real Time Linux Kernel packages in Red Hat Enterprise Linux (RHEL) 8.4 and RHEL 9.0 support channels. The updates address multiple kernel memory-safety and logic flaws, including use-after-free vulnerability **CVE-2022-3545** in the Netronome NFP driver, NULL-pointer dereference **CVE-2023-2166** in the CAN protocol implementation, and an out-of-bounds read/possible privilege-escalation issue, **CVE-2023-2176**, in the RDMA Connection Manager. They also remediate **CVE-2022-38096**, a vmwgfx driver NULL-pointer dereference that a local user with access to DRM device nodes could use to crash a host. Affected deployments include RHEL 9.0 Extended Update Support for SAP Solutions using `kernel-rt-5.14.0-70.85.1.rt21.156.el9_0`, and RHEL 8.4 Real Time variants using `kernel-rt-4.18.0-305.125.1.rt7.201.el8_4`, including long-life, telecommunications, and NFV support offerings. The advisories collectively fix additional use-after-free, reference-counting, memory-boundary, networking, netfilter, and local privilege-escalation defects; organizations should apply the applicable kernel-rt update and reboot affected systems to activate the fixes.
Aug 26, 2026